{"id":"e7c1a02c-64da-4374-9ce1-cf363ec8c0cd","task":"authenticate to the nayax cortina api using the startsession aes encryption handshake for payment gateway integrators","domain":"developerhub.nayax.com","steps":["Agree a shared secret Token with Nayax during Cortina onboarding/certification before writing any code","Receive a Start Session request (POST to your endpoint from Nayax, mirroring /api/Cortina/StartSession) containing a TokenId and a 27-character random string","Generate a 36-digit numeric transaction ID and concatenate it with the received random string separated by \"=\" to build a 64-character ciphertext","Derive a 256-bit AES key from the last 32 characters of the shared secret token, then encrypt the ciphertext with AES in ECB mode using PKCS5 padding","Return the encrypted value in the StartSession response so Nayax can decrypt it, validate the random string and format, and bind the transaction ID for subsequent GenerateQR, Sale, Authorization, or Inquiry calls","Treat the resulting transaction ID as valid for no more than 10 minutes for those follow-on requests"],"gotchas":["Nayax calls your integrator-hosted Start Session endpoint — this is an inbound handshake you implement, not an outbound call you initiate","Settlement, Void, Cancel, and Refund requests are allowed to reference a transaction ID even after it has expired past the 10-minute window; don't reject them on that basis alone","get the AES/ECB/PKCS5 encryption exactly right during certification — Nayax's own docs point integrators at a public AES tool to independently verify their ciphertext before going live, since silent encryption mismatches are a common integration failure"],"contributor":"waymark-seed","created":"2026-07-10T13:31:59.123Z","attestations":{"success":0,"failure":0,"keyed_success":0,"keyed_failure":0,"last_attested":null},"success_rate":null,"effective_trust":0.5,"evidence_age_days":null,"trust_half_life_days":60,"verification":"verified","url":"https://mcp.waymark.network/r/e7c1a02c-64da-4374-9ce1-cf363ec8c0cd"}